[BUG] ICE in (anonymous namespace)::ELFWriter::writeObject() [clone .constprop.0]

## Bug Report: ICE in (anonymous namespace)::ELFWriter::writeObject() [clone .constprop.0]

Clang crashes when compiling the following C code.

**Compiler**: clang-22 (LLVM 22.1.5, commit 5ea218a153f4d2f815b8244eab3e4b4ba5e00e6c)
**Compilation flags**: -O0
**Platform**: x86_64-linux-gnu
**Component**: frontend

This is a **frontend** crash (reproduces with `-emit-llvm -Xclang -disable-llvm-passes`).

## Reduced Test Case

> Minimized from the original fuzzer-generated input using `creduce`.

```sh
clang -O0 test.c -o /dev/null
```

```c
extern void abort();
typedef struct { short v16; } __attribute__((packed)) jint16_t;
struct node {
jint16_t magic;
jint16_t nodetype;
jint16_t totlen;
} __attribute__((packed));
struct node *node_p;
__asm__(
" .pushsection.data\n"
" .type __start_node, @object\n"
" .long __start_node\n"
" .size __start_node,.-__start_node\n"
" .popsection\n"
" .pushsection.data\n"
" .type __stop_node, @object\n"
" .long __stop_node\n"
" .size __stop_node,.-__stop_node\n"
" .popsection\n"
" .pushsection.data\n"
"node_p:\n"
" .quad __start_node\n"
".previous");
int main()
{
struct node marker = {
.magic = (jint16_t) {0x1985},
.nodetype = (jint16_t) {0x2003},
.totlen = node_p->totlen
};
if (marker.magic.v16 != 0x1985)
abort();
if (marker.nodetype.v16 != 0x2003)
abort();
return 0;
}
```

## Crash Output

```
:1:2: error: unknown directive
1 | .pushsection.data
| ^
:5:13: error: .popsection without corresponding .pushsection
5 | .popsection
| ^
:6:2: error: unknown directive
6 | .pushsection.data
| ^
:10:13: error: .popsection without corresponding .pushsection
10 | .popsection
| ^
:11:2: error: unknown directive
11 | .pushsection.data
| ^
:14:10: error: .previous without corresponding .section
14 | .previous
| ^
error: symbol 'node_p' is already defined
error: symbol 'node_p' is already defined
fatal error: error in backend: Size expression must be absolute.
clang: error: clang frontend command failed with exit code 70 (use -v to see invocation)
clang version 22.1.5 (https://github.com/llvm/llvm-project.git 5ea218a153f4d2f815b8244eab3e4b4ba5e00e6c)
Target: x86_64-unknown-linux-gnu
Thread model: posix
InstalledDir: /root/objects/llvm-project-release.obj/bin
Build config: \+assertions
clang: note: diagnostic msg:
********************
PLEASE ATTACH THE FOLLOWING FILES TO THE BUG REPORT:
Preprocessed source(s) and associated run script(s) are located at:
clang: note: diagnostic msg: /tmp/zGfDTnRpaXfq_surfuzz_4-2b6287.c
clang: note: diagnostic msg: /tmp/zGfDTnRpaXfq_surfuzz_4-2b6287.sh
clang: note: diagnostic msg:
********************
EXIT_CODE: 1
```

## Preprocessed Source & Run Script

**Preprocessed source** (`/tmp/zGfDTnRpaXfq_surfuzz_4-2b6287.c`):

```c
# 1 ""
# 1 "/root/outputs/experiments-on-metamut/surfuzz,clang,3/zGfDTnRpaXfq_surfuzz_4.c"
extern void abort();
typedef struct { short v16; } __attribute__((packed)) jint16_t;
struct node {
jint16_t magic;
jint16_t nodetype;
jint16_t totlen;
} __attribute__((packed));
struct node *node_p;
__asm__(
" .pushsection.data\n"
" .type __start_node, @object\n"
" .long __start_node\n"
" .size __start_node,.-__start_node\n"
" .popsection\n"
" .pushsection.data\n"
" .type __stop_node, @object\n"
" .long __stop_node\n"
" .size __stop_node,.-__stop_node\n"
" .popsection\n"
" .pushsection.data\n"
"node_p:\n"
" .quad __start_node\n"
".previous");
int main()
{
struct node marker = {
.magic = (jint16_t) {0x1985},
.nodetype = (jint16_t) {0x2003},
.totlen = node_p->totlen
};
if (marker.magic.v16 != 0x1985)
abort();
if (marker.nodetype.v16 != 0x2003)
abort();
return 0;
}

```

**Run script** (`/tmp/zGfDTnRpaXfq_surfuzz_4-2b6287.sh`):

```sh
# Crash reproducer for clang version 22.1.5 (https://github.com/llvm/llvm-project.git 5ea218a153f4d2f815b8244eab3e4b4ba5e00e6c)
# Driver args: "-O0" "/root/outputs/experiments-on-metamut/surfuzz,clang,3/zGfDTnRpaXfq_surfuzz_4.c" "-o" "/dev/null"
# Original command: "/root/objects/llvm-project-release.obj/bin/clang-22" "-cc1" "-triple" "x86_64-unknown-linux-gnu" "-O0" "-emit-obj" "-dumpdir" "/dev/null-" "-disable-free" "-clear-ast-before-backend" "-main-file-name" "zGfDTnRpaXfq_surfuzz_4.c" "-mrelocation-model" "pic" "-pic-level" "2" "-pic-is-pie" "-mframe-pointer=all" "-fmath-errno" "-ffp-contract=on" "-fno-rounding-math" "-mconstructor-aliases" "-funwind-tables=2" "-target-cpu" "x86-64" "-tune-cpu" "generic" "-debugger-tuning=gdb" "-fdebug-compilation-dir=/root/data" "-fcoverage-compilation-dir=/root/data" "-resource-dir" "/root/objects/llvm-project-release.obj/lib/clang/22" "-internal-isystem" "/root/objects/llvm-project-release.obj/lib/clang/22/include" "-internal-isystem" "/usr/local/include" "-internal-isystem" "/usr/lib/gcc/x86_64-linux-gnu/12/../../../../x86_64-linux-gnu/include" "-internal-externc-isystem" "/usr/include/x86_64-linux-gnu" "-internal-externc-isystem" "/include" "-internal-externc-isystem" "/usr/include" "-ferror-limit" "19" "-fgnuc-version=4.2.1" "-fskip-odr-check-in-gmf" "-faddrsig" "-fdwarf2-cfi-asm" "-o" "/tmp/zGfDTnRpaXfq_surfuzz_4-bbfa6e.o" "-x" "c" "/root/outputs/experiments-on-metamut/surfuzz,clang,3/zGfDTnRpaXfq_surfuzz_4.c"
"/root/objects/llvm-project-release.obj/bin/clang-22" "-cc1" "-triple" "x86_64-unknown-linux-gnu" "-O0" "-emit-obj" "-dumpdir" "/dev/null-" "-disable-free" "-clear-ast-before-backend" "-main-file-name" "zGfDTnRpaXfq_surfuzz_4.c" "-mrelocation-model" "pic" "-pic-level" "2" "-pic-is-pie" "-mframe-pointer=all" "-fmath-errno" "-ffp-contract=on" "-fno-rounding-math" "-mconstructor-aliases" "-funwind-tables=2" "-target-cpu" "x86-64" "-tune-cpu" "generic" "-debugger-tuning=gdb" "-fdebug-compilation-dir=/root/data" "-fcoverage-compilation-dir=/root/data" "-ferror-limit" "19" "-fgnuc-version=4.2.1" "-fskip-odr-check-in-gmf" "-faddrsig" "-fdwarf2-cfi-asm" "-x" "c" "zGfDTnRpaXfq_surfuzz_4-2b6287.c"

```

* found via a fuzzer

[zGfDTnRpaXfq_surfuzz_4-2b6287.c](https://github.com/user-attachments/files/29128407/zGfDTnRpaXfq_surfuzz_4-2b6287.c)
[zGfDTnRpaXfq_surfuzz_4-2b6287.sh](https://github.com/user-attachments/files/29128406/zGfDTnRpaXfq_surfuzz_4-2b6287.sh)

Start by running the provided clang command with the reduced C test case or attached run script, then compare behavior with -emit-llvm -Xclang -disable-llvm-passes. Trace the frontend failure around the reported ELFWriter::writeObject() crash and its diagnostic handling. Done means the reproducer no longer produces a fatal backend error while retaining appropriate diagnostics.

Written by the indexing model from the issue text.